b71331f2d76489a065ef163c4cdec9c8c09395ac4a9f310a068f8d198c2bb473

Analysis

max time kernel
112s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 19:49

Target

b71331f2d76489a065ef163c4cdec9c8c09395ac4a9f310a068f8d198c2bb473.exe
Size

186KB
MD5

5a4b09ef455d38535ca51055824cba86
SHA1

85a34292d6f1e4fad5577d62af8ad029f60cdbac
SHA256

b71331f2d76489a065ef163c4cdec9c8c09395ac4a9f310a068f8d198c2bb473
SHA512

044a0c31079e9c1690efdba5fad2f5fd862663bff7f0ffba544214d48c959c79bde0c3af96af964a4998598b0d0fedf0ee1d2d482112234cb7558ab5e65e0655
SSDEEP

3072:Bj1yMVF47jFV02r9ZFHk39KCFI94kAj7fwozeK7DmMRbs/i+IdQqRN1IiPHYU6mC:51FVF47Q2rWtrz4ozeKf5Rbsb0QqRkiE

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1768 set thread context of 5040	1768	b71331f2d76489a065ef163c4cdec9c8c09395ac4a9f310a068f8d198c2bb473.exe	80

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 5040	1768	b71331f2d76489a065ef163c4cdec9c8c09395ac4a9f310a068f8d198c2bb473.exe	80
PID 1768 wrote to memory of 5040	1768	b71331f2d76489a065ef163c4cdec9c8c09395ac4a9f310a068f8d198c2bb473.exe	80
PID 1768 wrote to memory of 5040	1768	b71331f2d76489a065ef163c4cdec9c8c09395ac4a9f310a068f8d198c2bb473.exe	80
PID 1768 wrote to memory of 5040	1768	b71331f2d76489a065ef163c4cdec9c8c09395ac4a9f310a068f8d198c2bb473.exe	80
PID 1768 wrote to memory of 5040	1768	b71331f2d76489a065ef163c4cdec9c8c09395ac4a9f310a068f8d198c2bb473.exe	80
PID 1768 wrote to memory of 5040	1768	b71331f2d76489a065ef163c4cdec9c8c09395ac4a9f310a068f8d198c2bb473.exe	80
PID 1768 wrote to memory of 5040	1768	b71331f2d76489a065ef163c4cdec9c8c09395ac4a9f310a068f8d198c2bb473.exe	80
PID 1768 wrote to memory of 5040	1768	b71331f2d76489a065ef163c4cdec9c8c09395ac4a9f310a068f8d198c2bb473.exe	80

C:\Users\Admin\AppData\Local\Temp\b71331f2d76489a065ef163c4cdec9c8c09395ac4a9f310a068f8d198c2bb473.exe
"C:\Users\Admin\AppData\Local\Temp\b71331f2d76489a065ef163c4cdec9c8c09395ac4a9f310a068f8d198c2bb473.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1768
- \??\c:\users\admin\appdata\local\temp\b71331f2d76489a065ef163c4cdec9c8c09395ac4a9f310a068f8d198c2bb473.exe
  "c:\users\admin\appdata\local\temp\b71331f2d76489a065ef163c4cdec9c8c09395ac4a9f310a068f8d198c2bb473.exe"
  2⤵
  PID:5040

memory/5040-133-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5040-135-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download